linux-kernel - Re: [PATCH 2/7] KVM: x86: Check guest debug in DR access instruction emulation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aTMbsunKNyxOFiKm@google.com>
Date: Fri, 5 Dec 2025 09:51:46 -0800
From: Sean Christopherson <seanjc@...gle.com>
To: Hou Wenlong <houwenlong.hwl@...group.com>
Cc: kvm@...r.kernel.org, Lai Jiangshan <jiangshan.ljs@...group.com>, 
	Paolo Bonzini <pbonzini@...hat.com>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, 
	Borislav Petkov <bp@...en8.de>, Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org, 
	"H. Peter Anvin" <hpa@...or.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/7] KVM: x86: Check guest debug in DR access instruction emulation

On Wed, Sep 10, 2025, Hou Wenlong wrote:
> @@ -8606,19 +8628,38 @@ static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask)
>  	}
>  }
>  
> -static void inject_emulated_exception(struct kvm_vcpu *vcpu)
> +static int kvm_inject_emulated_db(struct kvm_vcpu *vcpu, unsigned long dr6)
> +{
> +	struct kvm_run *kvm_run = vcpu->run;
> +
> +	if (vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP) {
> +		kvm_run->debug.arch.dr6 = dr6 | DR6_ACTIVE_LOW;
> +		kvm_run->debug.arch.pc = kvm_get_linear_rip(vcpu);
> +		kvm_run->debug.arch.exception = DB_VECTOR;
> +		kvm_run->exit_reason = KVM_EXIT_DEBUG;
> +		return 0;
> +	}
> +
> +	kvm_queue_exception_p(vcpu, DB_VECTOR, dr6);
> +	return 1;
> +}
> +
> +static int inject_emulated_exception(struct kvm_vcpu *vcpu)
>  {
> +	int r = 1;
>  	struct x86_emulate_ctxt *ctxt = vcpu->arch.emulate_ctxt;
>  
>  	if (ctxt->exception.vector == PF_VECTOR)
>  		kvm_inject_emulated_page_fault(vcpu, &ctxt->exception);
>  	else if (ctxt->exception.vector == DB_VECTOR)
> -		kvm_queue_exception_p(vcpu, DB_VECTOR, ctxt->exception.dr6);
> +		r = kvm_inject_emulated_db(vcpu, ctxt->exception.dr6);
>  	else if (ctxt->exception.error_code_valid)
>  		kvm_queue_exception_e(vcpu, ctxt->exception.vector,
>  				      ctxt->exception.error_code);
>  	else
>  		kvm_queue_exception(vcpu, ctxt->exception.vector);
> +
> +	return r;

Hmm, I think I'd rather make the DB_VECTOR case an early termination, and keep
the rest largely as-is.  And while you're modifying this code, maybe add a patch
to capture "struct x86_exception" locally instead of the context?  E.g. to end
up with:

static int inject_emulated_exception(struct kvm_vcpu *vcpu)
{
	struct x86_exception *ex = &vcpu->arch.emulate_ctxt->exception;

	if (ex->vector == DB_VECTOR)
		return kvm_inject_emulated_db(vcpu, ex->dr6);

	if (ex->vector == PF_VECTOR)
		kvm_inject_emulated_page_fault(vcpu, ex);
	else if (ex->error_code_valid)
		kvm_queue_exception_e(vcpu, ex->vector, ex->error_code);
	else
		kvm_queue_exception(vcpu, ex->vector);
	return 1;
}